dihcoin[.]xyz

This domain, dihcoin.xyz, is flagged as a brand impersonation threat specifically targeting Telegram users. Analysis indicates the site mimics legitimate cryptocurrency services associated with the Telegram platform, likely to facilitate fraudulent transactions or credential harvesting. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content align with known impersonation tactics used in crypto-related scams. The page title, 'dihcoin,' suggests an attempt to associate with a cryptocurrency or token, further reinforcing the impersonation narrative. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on August 20, 2025, through Name.com, Inc., and resolves to the IP address 18.208.88.157. Security vendors on VirusTotal flagged the domain at a rate of 4/95, indicating moderate detection but not yet widespread recognition. The domain appears on one security blocklist and is currently blocked by PhishDestroy. It employs a Let’s Encrypt SSL certificate and uses technologies such as Netlify and HSTS, which are common in both legitimate and malicious deployments. The Scamadviser trust score of 41/100 and Gridinsoft trust score of 0/100 further corroborate the domain’s suspicious nature. As of the latest assessment, dihcoin.xyz has been taken offline, reducing immediate exposure to potential victims. However, the domain’s infrastructure remains registered and could be reactivated or repurposed for future malicious campaigns. Users who interacted with the domain should monitor for unauthorized transactions, particularly in cryptocurrency wallets, and revoke any permissions granted to suspicious applications. Organizations should update blocklists to include this domain and its associated IP address to prevent future access. Given the elevated risk level, continued vigilance is advised, as threat actors may deploy similar domains to exploit Telegram’s user base.